Pulse-Level Simulation of Crosstalk Attacks on Superconducting Quantum Hardware

Syed Emad Uddin Shubha; Tasnuva Farheen

REVIEW 5 major objections 5 minor 11 references

Pulse-Level Simulation of Crosstalk Attacks on Superconducting Quantum Hardware

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Hardware crosstalk in shared superconducting quantum systems can be weaponized as a stealthy, pulse-level attack vector, with attacker-first pulse injection producing the largest biases in a victim's measurement distribution.

desk verdict Plausible simulation scan undercut by an instantaneous-victim-gate timing model; the coupling-type results are useful, the protocol-level attack ordering is not. read the letter →

arxiv 2507.16181 v2 pith:43TGHCRW submitted 2025-07-22 quant-ph cs.CR

Syed Emad Uddin Shubha , Tasnuva Farheen This is my paper

classification quant-phcs.CR PACS 03.67.Lx

keywords crosstalkattackpulse-levelsimulationsuperconductingquantumhardwaremulti-tenantcloudrotating-frameHamiltoniancoinflipXORclassifiersecurity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper seeks to show that persistent crosstalk between adjacent superconducting qubits is not just a fidelity nuisance but a viable active attack channel in multi-tenant quantum cloud systems. The authors simulate a three-qubit chain in the rotating frame, with static Pauli-Pauli couplings plus drive pulses that an adversary applies to her own qubits, and scan pulse shape, amplitude, detuning, and coupling type. They report that off-diagonal $Y\otimes X$ and $Z\otimes X$ couplings driven by cosine or chirp pulses generate the largest deviations in the victim's measurement distribution, with $L^2$ norms up to $0.0108$, and that attacker-first timing is the more damaging strategy. Case studies show the quantum coin flip protocol acquires a visible bias while a single-qubit XOR classifier remains almost unchanged, indicating that vulnerability depends on the victim's algorithmic structure. The upshot, if the simulations transfer to hardware, is that quantum cloud providers need to treat crosstalk as a security channel and defend it with protocol-aware countermeasures.

What carries the argument

The load-bearing object is the time-dependent rotating-frame Hamiltonian $H(t)=H_{\text{coupling}}+H_{\text{drive}}(t)$, where $H_{\text{coupling}}=J_{01}(\sigma^{(0)}\otimes\sigma^{(1)}\otimes I)+J_{12}(I\otimes\sigma^{(1)}\otimes\sigma^{(2)})$ encodes the always-on parasitic Pauli-Pauli couplings between adjacent qubits, and $H_{\text{drive}}(t)=A_0 f_0(t)\sigma_x^{(0)}+A_1 f_1(t)\sigma_x^{(1)}$ encodes the attacker's injected pulses. The rotating frame removes fast oscillation at the qubit frequencies so the simulation tracks the slower attack dynamics. The attack's strength is measured by the $L^2$ norm $\|\Delta p\|_2$ of the difference between the attacked and ideal measurement probability distributions on the victim qubit, and the parameter scan over pulse shapes, amplitudes, detunings, and coupling types identifies which channels carry the most influence.

What would settle it

Run the paper's scan on real hardware: with $J_{01}=J_{12}=0.5$ and $\delta=0$, apply a cosine pulse of amplitude $A_0=A_1=1.0$ to the attacker's qubits before the victim prepares $\cos\lambda |0\rangle+\sin\lambda |1\rangle$, then measure the victim's $|1\rangle$ probability; if the bias does not appear at the predicted scale (up to $0.0108$ in $L^2$ norm) or is identical whether the pulse is applied before or after the victim's operation, the central timing and coupling claims are wrong. A cheaper computational check is to add pure dephasing and amplitude decay to the master equation and see whether the attacker-first bias survives.

Watch

Extended reading notes

Core claim

The central claim is that hardware crosstalk in multi-tenant superconducting systems can be weaponized as a stealthy, pulse-level attack vector. In the paper's three-qubit model, an adversary with pulse-level control of the two qubits adjacent to the victim's qubit can inject shaped microwave pulses that, through the always-on nearest-neighbour couplings, alter the victim's state before or after its operation. The strongest quantitative results are the influence norms in Table II: $Y\otimes X$ and $Z\otimes X$ couplings with cosine or chirp pulses yield deviations of up to $0.0108$ in the victim's measurement probability distribution, outperforming square, DRAG, and Gaussian pulses. At the protocol level, attacker-first injection biases the quantum coin flip's output statistics, whereas victim-first injection is subtler; the XOR classifier stays robust, with deviations on the order of $10^{-2}$ even at maximum attack amplitude. The authors conclude that crosstalk vulnerability is protocol-dependent and that a detection-and-reset defense can contain the attacker to the less damaging victim-first regime.

Load-bearing premise

The attack model's load-bearing premise is that a static nearest-neighbour Pauli-Pauli coupling plus drive pulses on the attacker's qubits, integrated over a normalized time window with no decoherence or thermal noise, faithfully reproduces real multi-tenant superconducting hardware; if actual crosstalk channels include dominant terms outside this set, or if the attacker-first versus victim-first timing distinction does not hold for realistic pulse shapes, the predicted vulnerabilities and the detection-and-reset defense may not transfer.

Editorial extensions

If this is right

An adversary with pulse-level control over adjacent qubits can induce logical errors in a victim's computation without modifying the victim's circuit or code.
Off-diagonal crosstalk channels $Y\otimes X$ and $Z\otimes X$, driven by cosine or chirp pulses, are the dominant attack channels and should be the first targets for hardware mitigation.
Timing matters: injecting the malicious pulse before the victim's operation (attacker-first) is consistently more damaging than injecting it afterward (victim-first).
Protocol vulnerability is structural: precise-angle state preparation like the quantum coin flip is vulnerable, while discrete-rotation classifiers like the single-qubit XOR remain robust.
A practical defense is to run sensitive "canary" circuits on idle qubits to detect attack signatures and then perform high-fidelity reset of affected qubits, forcing subsequent pulses into the weaker victim-first regime.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The attacker-first versus victim-first asymmetry suggests that quantum cloud orchestrators might shrink the attack window by scheduling state-preparation gates immediately after qubit reset, though the paper does not test this scheduling defense.
Because the model omits decoherence and thermal noise, a natural next experiment is to repeat the parameter scan with finite $T_1$ and $T_2$; noise could either mask the coherent bias or, if it interacts with the injected drive, enlarge it.
The same Hamiltonian simulation could be used to evaluate defensive pulse engineering, such as dynamical decoupling sequences or echoed crosstalk cancellation, before committing to hardware trials.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is a clearly written simulation study, but the headline protocol-level result — attacker-first beats victim-first — is built on an ideal zero-duration victim gate, so the timing comparison may be a unitary-ordering artifact. The coupling-type scan is the more defensible part.

What's actually new: the paper simulates a time-dependent three-qubit Hamiltonian with a scan over pulse shape, amplitude, and coupling type, and compares two concrete protocols. That is a step beyond earlier circuit-level or side-channel crosstalk work, and the qualitative conclusion that off-diagonal YX/ZX couplings are the most damaging channels is plausible and worth recording. The XOR classifier robustness is a nice, non-obvious observation about protocol-dependent vulnerability. The paper is honest about omitting decoherence and noise.

Soft spots, in order of importance. First, the stress-test concern is real: the victim's rotation V(λ) is inserted as an instantaneous ideal gate, while the attack unitary is computed by integrating the full Hamiltonian over t∈[0,1]. So 'attacker-first' vs 'victim-first' is exactly the difference between U_pulse·V and V·U_pulse for one fixed U_pulse. On real hardware, the victim's gate is itself a finite-duration drive and the always-on coupling never switches off; the model cannot represent overlapping or simultaneous pulses, which is the most relevant attack scenario. Second, with δ=0 (the protocol-level setting), the cosine 'pulse' is a constant drive over the whole window, so the attack is not time-localized at all; Table II lists identical norms for cosine and chirp, which looks like a parameter artifact and needs explanation. Third, the numerical side is thin: no convergence check on the 50-step integration, no sensitivity analysis, and no code/data artifacts. Fourth, the mitigation strategy (reset after detection) depends on the attacker-first/victim-first distinction, so it inherits the timing-model problem.

None of this kills the paper's basic value as a threat-modeling exercise. The scan over coupling types and the protocol comparison are useful initial results, even if the quantitative norms (around 0.01) and the exact ordering claims should not be taken as hardware predictions. The authors themselves flag the idealization.

Who is this for: researchers working on quantum cloud security who want a quick, readable starting point for what a pulse-level crosstalk attack might look like. It deserves a serious referee — the topic is timely and the simulation is reproducible in principle — but a referee should push hard on the gate-timing model and request code, error analysis, and a cleaner pulse parameterization.

Referee Report

5 major / 5 minor

Summary. The paper studies a three-qubit superconducting device in a multi-tenant cloud setting, where an attacker (Eve) applies pulse-level microwave drives to her two qubits and exploits always-on crosstalk couplings to corrupt the computation of a victim (Adam) on the third qubit. The authors model the dynamics with a rotating-frame Hamiltonian consisting of static nearest-neighbor Pauli couplings plus time-dependent drive terms, integrate the Schrödinger equation with QuTiP, and scan pulse shapes (cosine, Gaussian, square, chirp, DRAG) and coupling types (ZX, YX, etc.). They report the L2 norm of the victim measurement-distribution deviation for each configuration (Table II), then test two attack timings (attacker-first and victim-first) on two single-qubit protocols: a biased quantum coin flip and an XOR classification circuit. They conclude that crosstalk can be weaponized as a stealthy pulse-level attack vector, that protocol vulnerability is protocol-dependent, and that a canary-circuit detection plus reset mitigation strategy can force the attacker into the less damaging victim-first regime.

Significance. If the quantitative results were reliable, this would be a useful first contribution to the emerging literature on active crosstalk attacks in multi-tenant quantum systems. A strength of the work is that it is a forward simulation: no parameters are fitted to the target conclusions, and the protocol-level simulations are directly generated from the stated Hamiltonian, so the paper's claims are at least internally defined. The qualitative observation that state-preparation-like protocols are more sensitive to coherent crosstalk than protocols built from large discrete gates is plausible and worth testing. However, the paper's central quantitative and timing claims are currently not supported by the described model, as detailed in the major comments.

major comments (5)

[§III-B, §V-A, Fig. 2] The attacker-first versus victim-first distinction is implemented as the ordering of a fixed attack unitary U_pulse with an idealized, zero-duration victim gate V(λ). Because V(λ) is not part of the Hamiltonian integration, the comparison is exactly U_pulse·V versus V·U_pulse. On real hardware, Adam's rotation is itself a finite-duration microwave drive, and the always-on crosstalk Hamiltonian remains active while it is being applied. The most relevant attack scenario is simultaneous or overlapping pulses, which the model cannot represent because the coupling is effectively switched off during the victim gate. The conclusion that attacker-first injection biases the coin flip while victim-first is subtle, and the proposed reset mitigation that forces the adversary into the victim-first regime, therefore rests on a unitary-ordering artifact rather than on a physically modeled pulse-timing attack.
[Table I, §V] With the stated detuning δ=0 used in the protocol-level simulations, the cosine pulse shape A cos(δt) is simply the constant A over the whole interval t∈[0,1]. It is not a time-localized pulse. Moreover, Table II reports identical influence norms for the cosine and chirp rows (0.0108 for YX and 0.0073 for ZX), which is unexplained unless the chirp parameters reduce to the same function. This undermines the claimed pulse-shape ranking and the implicit localization of the attack in time.
[§IV, Table II] Table II gives no values for the amplitudes A0, A1, the chirp rate c, the DRAG parameter α, the Gaussian width σ, or the coupling strengths used in the scan. The time discretization is stated to be 50 steps in §III-C, but no convergence test or sensitivity analysis is reported. The quantitative ranking of crosstalk channels, including the claim that YX and ZX couplings are the most potent, is therefore not verifiable from the manuscript.
[§V-B, Fig. 5] The claim that the XOR classifier is robust because discrete rotations prevent the coherent error from crossing a logical decision boundary is plausible but is not backed by a quantitative analysis of where the boundary lies. Figure 5 reports a 'maximum deviation' curve, but the text does not state which pulse shape, coupling type, attack timing, or input combination (x1,x2) produced that maximum, nor how it varies across the four input cases.
[§VI, Limitations] The Limitations paragraph explicitly concedes that decoherence and thermal noise are omitted and that no experimental validation is performed. Because the paper's headline claim is stealthiness on real hardware—specifically that an attack can evade error-mitigation and noise-floor detection—this omission is load-bearing, not a routine abstraction. The manuscript should either quantify the expected impact of noise on the reported norms and biases or weaken the real-hardware claims accordingly.

minor comments (5)

[§III-A] The notation σ(i) is not defined explicitly as the Pauli operator acting on qubit i, and the tensor-product terms are written with two-factor products (σ⊗σ⊗I) in a way that is clear only by context; a formal definition would help.
[§III-B] There is a typo in 'before victim; Adam, initializes'; it should read 'before Adam initializes'.
[§IV] The L2 norm definition uses p_i without specifying that these are single-qubit marginal probabilities on q2, nor how the ideal probabilities are computed. This should be made precise.
[§V-A] The statement that victim-first against an unbiased coin (λ=45°) produces output 'statistically identical' to the ideal case is a strong quantitative claim that is neither shown numerically nor given a statistical tolerance; if it is intended as a prediction, it deserves a concrete figure or table.
[References] Some citations are used loosely: reference [5] is cited for the QuTiP solver but the reference is to a paper on pulse-level noisy quantum circuits, and reference [9] is cited without a full context for the single-qubit XOR construction. The reference list should be checked for consistency.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is a forward simulation whose outputs (Table II norms, coin-flip bias, XOR robustness) are direct numerical solutions of the stated time-dependent Hamiltonian; no quantity is fitted to or defined by the target result.

full rationale

The paper's derivation chain is a standard forward simulation. The system Hamiltonian H(t) = H_coupling + H_drive(t) is stated explicitly (Section III-A); adversarial timing (attacker-first/victim-first) is implemented by placing the integrated attack unitary before or after the victim's gate (Figure 2); and all reported quantities — Table II influence norms, Figure 3 coin-flip bias, Figure 5 XOR deviations — are computed by numerically integrating the Schrödinger equation with those fixed parameters (QuTiP mesolve, Section III-C). None of these outputs is used as an input to define the Hamiltonian, no parameter is fitted to the claimed vulnerabilities, and no conclusion is assumed by construction. The paper cites prior work for the rotating-frame convention [10,11], for QuTiP [5], and for crosstalk threat models [2,6,7,8]; these citations are contextual and none is load-bearing in the sense of supplying the central result. The Limitations paragraph explicitly acknowledges that decoherence and thermal noise are omitted; that is an honest scope caveat about model realism, not a circularity. The skeptic's observation that victim gates are idealized and pulses at delta = 0 are not time-localized concerns whether the model's assumptions transfer to hardware, which is model-dependence and correctness risk, not circular reasoning. No circular step can be quoted from the paper.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central results are generated by a hand-parameterized simulation: coupling strengths, drive amplitudes, detuning, pulse-shape coefficients, and the time grid are all chosen by the authors rather than fitted or validated against hardware. The model also assumes a specific two-term Hamiltonian and no decoherence. Because none of these parameters is anchored to a measured device, the quantitative outputs are outputs of the chosen model, not independent predictions. No new physical entities are introduced.

free parameters (5)

Coupling strengths J01, J12 = J01 = J12 = 0.5
Chosen by hand as a moderate symmetric coupling for protocol-level runs (Section V); the scan in Section IV also assumes J01 = J12.
Drive amplitudes A0, A1 = 0.5 (moderate), 1.0 (aggressive)
Set by hand in Section V-A; no link to hardware calibration or a noise floor.
Drive detuning delta = 0 for protocol-level runs
Set to zero in Section V, which makes the cosine pulse shape a constant over the normalized interval in Table I.
Pulse shape parameters (sigma, chirp rate c, DRAG alpha) = not reported
Table I defines Gaussian, chirp, and DRAG forms with these parameters, but no values are given, so those rows cannot be reproduced.
Time discretization steps = 50 steps over t in [0,1]
Chosen in Section III-C without a convergence check or error estimate.

assumptions (5)

standard math Time-dependent Schrodinger equation with purely unitary evolution governs the three-qubit system.
Invoked in Section III-C, with mesolve solving it; decoherence is deliberately omitted.
domain assumption Rotating-frame and rotating-wave approximations remove fast-oscillating terms while preserving the dynamics relevant to drives and crosstalk.
Section III-A states this standard technique is used, but no validity conditions are given for the chosen amplitudes and detunings.
domain assumption Crosstalk is fully captured by a static nearest-neighbor Pauli-Pauli coupling term and a drive term on q0 and q1 only.
Section III-A defines the total Hamiltonian with these two terms; direct q0-q2 coupling, higher-order terms, and drive-induced shifts are not modeled.
domain assumption Attacker-first and victim-first attack timing can be represented by injecting pulses before or after the victim's operation within the normalized time window.
Section III-B defines the two strategies, but the pulse shapes in Table I are not gated to explicit intervals for the cosine and chirp cases, so the timing distinction is not fully specified.
domain assumption Decoherence and thermal noise have negligible effect on the attack dynamics.
Stated in the Limitations paragraph; this isolates coherent crosstalk but is acknowledged as an idealization.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Pulse-Level Simulation of Crosstalk Attacks on Superconducting Quantum Hardware." pith.science (2026). https://pith.science/paper/43TGHCRW

@misc{pith2026250716181,
  author       = {Pith},
  title        = {Pith review of: Pulse-Level Simulation of Crosstalk Attacks on Superconducting Quantum Hardware},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/43TGHCRW}},
  note         = {Machine review of arXiv:2507.16181}
}

read the original abstract

Hardware crosstalk in multi-tenant superconducting quantum computers poses a severe security threat, allowing adversaries to induce targeted errors across tenant boundaries by injecting carefully engineered pulses. We present a simulation-based study of active crosstalk attacks at the pulse level, analyzing how adversarial control of pulse timing, shape, amplitude, and coupling can disrupt a victim's computation. Our framework models the time-dependent dynamics of a three-qubit system in the rotating frame, capturing both always-on couplings and injected drive pulses. We examine two attack strategies: attacker-first (pulse before victim operation) and victim-first (pulse after), and systematically identify the pulse and coupling configurations that cause the largest logical errors. Protocol-level experiments on quantum coin flip and XOR classification circuits show that some protocols are highly vulnerable to these attacks, while others remain robust. Based on these findings, we discuss practical methods for detection and mitigation to improve security in quantum cloud platforms.

Figures

Figures reproduced from arXiv: 2507.16181 by the authors.

**Figure 1.** Illustration of a crosstalk attack. The attacker (Eve) injects microwave pulses into q0 and q1, creating crosstalk that perturbs the victim’s qubit (q2), used by Adam. • Eve has complete, pulse-level control over the parameters (shape, amplitude, frequency, timing) for q0 and q1 but cannot directly access q2 or Adam’s circuit. • Adam uses q2 through standard gate-based instructions and is unaware of any attack, attr… view at source ↗

**Figure 2.** Experimental circuit for protocol-level attack assessment. Attack pulse is injected at either node a or b. A. Case Study 1: Biased Quantum Coin Flip We first assess attack impact on a single-qubit state preparation protocol where the victim, Adam, prepares the state |ψ(λ)⟩ = cos λ |0⟩ + sin λ |1⟩ using the rotation V (λ) = e −iλY . The ideal measurement probability is P(|1⟩) = sin2 λ. This protocol’s reliance on the… view at source ↗

**Figure 3.** compares two configurations: a moderate cosine–cosine pulse setup (A0 = A1 = 0.5) and an aggressive cosine–chirp setup (A0 = A1 = 1.0). In both cases, attacker-first injection corrupts the state before rotation, causing a measurable bias in output statistics. This is because the adversarial pulse corrupts the initial state before the victim’s rotation is applied; the victim’s own gate then acts on this already-compr… view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Quantum circuit for XOR classification. The XOR classifier demonstrates high resilience to the crosstalk attack. Even at maximum strength, the induced change in output statistics is minimal, on the order of 10−2 , as seen in [PITH_FULL_IMAGE:figures/full_fig_p003_4.png]

**Figure 5.** Figure 5: Maximum deviation in XOR classifier output as a function of attack amplitude observing minor changes under strong attack. VI. IMPLICATIONS & MITIGATION STRATEGY Our findings have direct implications for the security of multi-tenant quantum hardware. The core insight is…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

11 extracted references · 10 canonical work pages

[1]

Suppression of qubit crosstalk in a tunable coupling superconducting circuit,

P. Mundada and et.al., “Suppression of qubit crosstalk in a tunable coupling superconducting circuit,” Physical Review Applied , vol. 12, no. 5, p. 054023, 2019

work page 2019
[2]

Analysis of crosstalk in nisq devices and security implications in multi-programming regime,

A. Ash-Saki and et.al., “Analysis of crosstalk in nisq devices and security implications in multi-programming regime,” in Proceedings of the ACM/IEEE International Symposium on Low Power Electronics and Design, 2020

work page 2020
[3]

Experimental characterization of crosstalk errors with simultaneous gate set tomography,

K. Rudinger and et.al., “Experimental characterization of crosstalk errors with simultaneous gate set tomography,” PRX Quantum, 2021

work page 2021
[4]

Quantum crosstalk analysis for simultaneous gate operations on superconducting qubits,

P. Zhao and et.al., “Quantum crosstalk analysis for simultaneous gate operations on superconducting qubits,” PRX quantum , vol. 3, no. 2, p. 020301, 2022

work page 2022
[5]

Pulse-level noisy quantum circuits with qutip,

B. Li and et.al., “Pulse-level noisy quantum circuits with qutip,” Quantum, 2022

work page 2022
[6]

Understanding side-channel vulnerabilities in superconducting qubit readout architectures,

S. Maurya and et.al., “Understanding side-channel vulnerabilities in superconducting qubit readout architectures,” in 2024 IEEE International Conference on Quantum Computing and Engineering (QCE), vol. 1. IEEE, 2024, pp. 1177–1183

work page 2024
[7]

Crosstalk-induced side channel threats in multi-tenant nisq computers,

N. Choudhury and et.al., “Crosstalk-induced side channel threats in multi-tenant nisq computers,” arXiv preprint arXiv:2412.10507 , 2024

arXiv 2024
[8]

Jailbreaking quantum computers,

C. Xu and et.al., “Jailbreaking quantum computers,” arXiv e-prints, pp. arXiv–2406, 2024

work page 2024

Show all 11 references

[9]

Single qubit neural quantum circuit for solving exclusive-or,

I. Grossu, “Single qubit neural quantum circuit for solving exclusive-or,” MethodsX, vol. 8, p. 101573, 2021

2021
[10]

Hamiltonian engineering with multicolor drives for fast entangling gates and quantum crosstalk cancellation,

K. Wei and et.al., “Hamiltonian engineering with multicolor drives for fast entangling gates and quantum crosstalk cancellation,” Physical Review Letters, vol. 129, no. 6, p. 060501, 2022

2022
[11]

First-principle crosstalk dynamics and hamiltonian learning via rabi experiments,

J. Balewski and et.al., “First-principle crosstalk dynamics and hamiltonian learning via rabi experiments,” arXiv preprint arXiv:2502.05362, 2025

2025 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Suppression of qubit crosstalk in a tunable coupling superconducting circuit,

P. Mundada and et.al., “Suppression of qubit crosstalk in a tunable coupling superconducting circuit,” Physical Review Applied , vol. 12, no. 5, p. 054023, 2019

work page 2019

[2] [2]

Analysis of crosstalk in nisq devices and security implications in multi-programming regime,

A. Ash-Saki and et.al., “Analysis of crosstalk in nisq devices and security implications in multi-programming regime,” in Proceedings of the ACM/IEEE International Symposium on Low Power Electronics and Design, 2020

work page 2020

[3] [3]

Experimental characterization of crosstalk errors with simultaneous gate set tomography,

K. Rudinger and et.al., “Experimental characterization of crosstalk errors with simultaneous gate set tomography,” PRX Quantum, 2021

work page 2021

[4] [4]

Quantum crosstalk analysis for simultaneous gate operations on superconducting qubits,

P. Zhao and et.al., “Quantum crosstalk analysis for simultaneous gate operations on superconducting qubits,” PRX quantum , vol. 3, no. 2, p. 020301, 2022

work page 2022

[5] [5]

Pulse-level noisy quantum circuits with qutip,

B. Li and et.al., “Pulse-level noisy quantum circuits with qutip,” Quantum, 2022

work page 2022

[6] [6]

Understanding side-channel vulnerabilities in superconducting qubit readout architectures,

S. Maurya and et.al., “Understanding side-channel vulnerabilities in superconducting qubit readout architectures,” in 2024 IEEE International Conference on Quantum Computing and Engineering (QCE), vol. 1. IEEE, 2024, pp. 1177–1183

work page 2024

[7] [7]

Crosstalk-induced side channel threats in multi-tenant nisq computers,

N. Choudhury and et.al., “Crosstalk-induced side channel threats in multi-tenant nisq computers,” arXiv preprint arXiv:2412.10507 , 2024

arXiv 2024

[8] [8]

Jailbreaking quantum computers,

C. Xu and et.al., “Jailbreaking quantum computers,” arXiv e-prints, pp. arXiv–2406, 2024

work page 2024